Individual Liability for Medicare Overpayment Claims
Personal liability of individual owners of health care provider companies for claims against the company by CMS or Federal contractor
1. Scope of this Article. This article addresses the case where an individual or “natural person” owns an interest in a Medicare health care provider which is incorporated under the laws of a state, as a corporation, limited liability company, limited partnership, or another type of legal person. The individual may be a shareholder, member, limited partner, or some corresponding term for an owner of the company, but in all these cases the common factor is limitation of liability of owners.
Owners of providers facing ZPIC or other Medicare contractor audits or appealing an overpayment demand often ask what risk they face of being held personally liable for the overpayment claims, or otherwise punished personally, if their appeals are unsuccessful.
2. Definition of Our Case. The hypothetical situation addressed here is a common one, namely a provider organized as a corporation or LLC (the “Company”) with one or more individual owners (i.e. individual shareholders or members) is enrolled with Medicare, has provided services to Medicare beneficiaries over a substantial period of time, and has received payments from one or more Medicare contractors. Then, a ZPIC or similar contractor selects the Company for post-payment audit. After reviewing a sample of records, the contractor determines that overpayments have occurred and issues an audit results letter assessing an amount claimed to be overpaid in the sample, and an extrapolated (much larger) amount deemed to be overpaid in all of the Company’s Medicare receipts during the period under review. The Medicare Administrative Contractor (the “MAC”) then makes a written formal demand for refund by the Company of the extrapolated amount.
Our hypothetical assumes the Company either fails to appeal the above overpayment determination (referred to as an “Initial Determination”), or appeals and loses. Either way the Company owes the full extrapolated amount to CMS, plus interest from the date of the formal demand by the MAC. Assume further that this sum amounts to several years’ gross revenues for the Company; and it has no means to repay it. The MAC begins recoupment from payments of new Medicare billings by the Company, and the Company shuts down as it exhausts its funds available to cover payroll and operating expenses. Finally, assume (as is commonly the case) that the Company has no significant assets which CMS can seize and liquidate to satisfy the overpayment.
Given the above, the question presented is whether the individual owner or owners of the Company are on the hook for the unpaid amount of the CMS overpayment claim? Are other provider entities owned by the same individuals on the hook? Phrased another way, under what circumstances can CMS or its contractors lawfully collect the above overpayment from the individual owners or their other provider companies? And what other sanctions can the Government apply against the individuals and affiliates in such a case?
3. Concept of Limited Liability. In the US and most Western legal systems the concept of incorporation of a business is available to shield its owners from claims for the business’s debts. This is the concept of limited liability, meaning the owners’ personal liability for the debts of the business is usually limited to the amount of the capital they have invested in it. If the business owes money to a creditor, the creditor will have recourse to the business, meaning the money and other assets the business itself owns. In this way, the creditor can collect the capital the owner has bound up in the business; but the creditor has no right to make the owner pay from his own assets.
4. Threshold Rule of Limited Liability; Exceptions and “Piercing the Corporate Veil.” The general rule of limited liability applies to CMS and its contractors when dealing with shareholders of incorporated health care providers, just as it does to other creditors. No statute or case law makes owners of incorporated Medicare health care providers personally liable for their companies’ debts to CMS, except in certain very narrow circumstances which apply to all debtors and creditors. And nothing about the health care industry makes these circumstances more likely to arise than in other industries.
The principal exceptions to the rule of limited liability of shareholders are collectively known as piercing the corporate veil. Under certain circumstances, courts will allow creditors of an insolvent corporation, LLC or other legal entity to reach through the corporate structure and collect their debts from shareholders or similar owners. Numerous factors have been cited by courts to justify imposing liability of shareholders for corporate debts, and an exhaustive discussion of this topic is beyond the scope of this article; but common examples of circumstances which can justify veil piercing are as follow:
(a) Defective Incorporation. Failure to meet legal the statutory requirements for organizing the corporation or LLC can and will result in shareholders being liable for corporate debts. A better statement of this rule is that, without compliance with the requirements for incorporation, no corporation ever exists in the first place to shield the shareholders from liability.
(b) Ignoring the Separateness of the Corporation. Entering into contracts and otherwise transacting business variously in a corporate name and an individual name can justify piercing the corporate veil. Likewise, commingling corporate and individual assets, or transferring assets without formalities between company and owner, or company and sister company, can give the same result.
(c) Significant Undercapitalization. A requirement of incorporation is injecting money or other capital into the new company reasonably sufficient to pay its expected debts. Failure to do this is called undercapitalization, and is grounds to impose liability on the shareholders. The adequacy of capital, however, is judged at the time it is injected, not when the liability arises, and courts tend to defer to any good-faith estimate of how much capital will be needed, so undercapitalization is normally difficult to prove.
(d) Excessive Dividends or Other Payments to Shareholders. When owners are actually working for a corporation they can in most cases pay themselves whatever compensation is even remotely fair, as long as it is clearly characterized as salary or wages. Dividends and other non-compensation distributions, however, are judged very differently, and can safely be taken out by shareholders only to the extent of profits. When shareholders take non-compensation distributions in excess of profits, they constitute a return of capital and can give rise to an undercapitalization claim by any corporate creditor who is subsequently not paid. If such distributions are made when the corporation is actually insolvent, the creditors’ claims against the shareholders will be almost impossible to defend.
(e) Misrepresentation and other Unfair Dealings with Creditors. Dishonesty and false statements to corporate creditors, asset concealment and other deceptive practices, can make shareholders liable for corporate debts.
(f) Absence or Inaccuracy of Records. If corporate records go missing or prove to be inaccurate, they can form a basis to pierce the corporate veil, especially if they hinder a creditor’s collection efforts against the corporation.
(g) Failure to Maintain Ongoing Legal Requirements. Each state’s statutes impose annual franchise fees and various report-filing requirements on corporations and similar entities. Although these have generous grace periods and cure provisions, if they are neglected long enough, the corporation or LLC will legally cease to exist and shareholder liability will result.
Given any of the above fact circumstances, CMS and its Medicare contractors can seek to pierce the Company’s corporate veil and collect the overpayment from the Company’s owners in our hypothetical. These circumstances however are not typical for health care providers, and are easily avoided. Veil piercing depends on facts which by their nature are difficult to prove in a court of law, often involve subjective judgments, and in most cases are subject to dispute. The burden of proving the facts is always on the creditor. Correspondingly, courts tend to disfavor veil-piercing claims and narrowly construe the applicable law, so veil piercing has a reputation as a difficult remedy to invoke successfully.
5. Rules in Bankruptcy. While CMS does enjoy certain advantages and unique rights under US Bankruptcy laws, this doesn’t include any advantage over other creditors in reaching the pockets of shareholders of a bankrupt company.
A basic rule in Bankruptcy is that filing a petition automatically halts or “stays” all acts by creditors to collect debts which pre-date the petition. Since 2005, this “automatic stay” has been ruled not to impair CMS’s right to exclude providers from its programs. Additionally, Federal case law appears to hold that the automatic stay does not prevent CMS and its contractors from recoupment against new Medicare billings by a provider in bankruptcy. But no bankruptcy law gives Government health care programs special debt collection rights against shareholders of providers, so CMS and its contractors, like other creditors, can collect Medicare overpayments from shareholders and other owners of a bankrupt entity only in the Veil Piercing circumstances described above, which are narrowly-drawn and strictly interpreted against the creditor.
6. Federal Agency Practice on Pursuing Individual Liability. Federal agencies are not as a rule aggressive in collection of their debt claims, and CMS is no exception. For example, in government loan programs where shareholders are required personally to guarantee the debt, once corporate assets are exhausted in default cases, Federal agencies rarely pursue the guarantors’ personal credit, and discourage their contractors and even private holders of Government-guaranteed loans from doing so. With this in mind, it should be no surprise that most Federal agencies seldom if ever seek to pierce any corporate veil. As was noted, veil-piercing involves lots of gray areas and disputed facts and is hard to do successfully; and Government agencies are reluctant to risk the time and money required. Government agencies also fear the adverse publicity that regularly arises from collection efforts against individuals. While Federal authorities could be moved to pursue such remedies in an extreme case or under the glare of unusual publicity, they are otherwise unlikely to do so. In 30+ years of representing participants in Federal programs, I have never been involved in any case where such a remedy was sought against a client or any other individual.
7. Successor Liability. In our hypothetical, the individual owners won’t be able to continue in the health care industry using the Company itself as a practice vehicle. They may wish to organize and capitalize another entity to provide the same or a similar type of services. In what circumstances can new entities organized by the owners after the Company’s demise be held liable for the Company’s overpayment obligation? This area of the law is referred to as successor liability, and it provides remedies which do indeed allow creditors to pursue the new entity in some cases. Like veil piercing, this remedy is an exception to the general rule of limited liability of corporate owners, is available to creditors generally in certain narrow circumstances, and is not specific to Government creditors or health care provider debtors.
Simply stated, successor liability flows from state statutes and state court case rulings which allow the creditors of a debtor company to collect their debt claims from another company to which one or more assets of the debtor have been transferred, if it is a successor to the original debtor. The exact circumstances which make the other company a successor vary from state to state. In most states the law gives a list of elements which can establish successor status, but uses a balancing test, meaning there is no hard and fast rule of which or how many elements have to be present to prove the claim. The creditor sues the transferee company to initiate such a claim, and the court hearing the case decides not only which elements are present, but also whether they are enough to make the defendant a successor. But if a creditor can prove enough of them, it can make the transferee pay the debt.
Elements commonly listed to impose liability on the transferee of a debtor’s assets include, (i) common ownership (whole or part) between the original debtor and the separate company; (ii) the transferee was established to hinder the creditors of the debtor; (iii) the original debtor and the transferee company provide the same goods or services; (iv) the same or recognizably similar company name or DBA; (v) same business location; (vi) same customers or customer sources; (vii) same officers or managers; (viii) same employees; and (ix) the transferee pays other debts of the original debtor, or states that it will do so. In most cases, one or two elements alone will usually be insufficient to establish liability.
Successor liability is not as uniformly disfavored in courts as is veil piercing, but remains uncommon in practice. Like veil piercing, it is rarely if ever used by Federal agencies and contractors. Whether any specific circumstances will make a transferee company liable as a successor to another is beyond the scope of this article; but asset transfers between commonly-owned companies occur frequently, and many not easily be identifiable as such to a non-lawyer. In our hypothetical, the Company’s owners may be sorely tempted to use the same business location or same employees or managers in the new provider as in the Company, and may wish to have the new entity collect unpaid receiveables. Any of these steps could subject the new entity to the overpayment, or to any other creditor claim. Successor liability can be invoked against pre-existing entities under common ownership with the Company as well. Owners of health care providers having other companies which are subject to any Medicare contractor collection action need to avoid any such transfers scrupulously, and bear in mind that they can make their other provider liable in common for an overpayment claim.
8. Other Government Sanctions Against Owners and Affiliates for Non-payment by an Incorporated Provider. Pursuing owners personally for repayment of a provider’s overpayment liability isn’t the only sanction CMS and its contractors might logically seek to apply to punish non-payment. Excluding related persons and companies from health care program participation comes to mind. This could take at least 3 forms, each of which we will examine in turn.
(a) Exclusion of Individual Owners. The authority for HHS to exclude both companies and individuals from involvement in its health care programs has been established at the statute, regulation, and policy manual levels.
The basic authority for exclusion is granted to the Secretary of HHS under Sections 1128 and 1156 of the Social Security Act. These sections list all the grounds for which a party may be excluded. Most of these sections are written so that if an entity commits acts which are grounds for exclusion, the owners are likewise at risk. Most of the grounds for exclusion are not relevant here, such as conviction for felonies, or health care related misdemeanors. Three grounds for exclusion however are listed which relate to providers’ services, namely submitting charges to any Federal health care program in excess of the provider’s usual charges, furnishing services in excess of the needs of patients, and furnishing services of a quality not meeting recognized professional standards. The lack of medical necessity grounds for denial which appear in most overpayment cases, corresponds to the furnishing services in excess of the needs of patients grounds for exclusion. So the question is whether lack of medical necessity of our Company’s services is, in and of itself, valid grounds to exclude it, and therefore also exclude its owners?
These service-related grounds for exclusion are addressed in the Medicare Program Integrity Manual (the “PIM”) in Chapter 4, Sec. 4.19. This section states that
In order to prove such cases, the PSC and the ZPIC BI unit shall document a long-standing pattern of care where educational contacts have failed to change the abusive pattern. Isolated instances and statistical samples are not actionable. Medical doctors must be willing to testify.
Only this service-related grounds for exclusion could plausibly be applied to the facts of our overpayment hypothetical, without serious wrongdoing being present beyond simple failure to repay. The contractor documentation in a typical post-payment audit would not appear to satisfy the PIM requirement of “document[ing] a long-standing pattern of care where educational contacts have failed to change the abusive pattern”. No practitioner at this health care law firm has seen exclusion attempted or threatened against the provider or its owners in a simple overpayment case. Accordingly, exclusion of the provider and its individual owner does not appear to be a substantial risk in our hypothetical situation.
(b) Bars to Subsequent Applications. In our hypothetical, the individual owners won’t be able to continue in the health care industry using the Company itself as a practice vehicle. They may wish to organize and capitalize another entity to provide the same or a similar type of services. If our hypothetical is extended to such a case, what are the risks that CMS and its contractors might punish the Company’s failure to satisfy its proven overpayment demand, by barring the enrollment application of the owner’s new provider entity?
In order to bar a new provider owned or controlled by owners of our hypothetical defaulting provider, however, CMS and its contractors must be aware of the relationship between the 2 companies. So our initial inquiry must be whether the new-provider enrollment process will itself call the attention of CMS or its contractors to the relationship between the non-paying Company and the new applicant. This process is largely embodied in the enrollment application document. The current form of Medicare enrollment application for most incorporated providers, CMS-855A (07/11) requires disclosure of any “Adverse Legal Actions/Convictions” of individuals with ownership or control of the entity (in Sec. 6), and so would clearly be required for the Company’s owners in our hypothetical. The listing of adverse adjudications which constitute Adverse Legal Actions/Convictions is at page 16 in the CMS-855A, and includes most criminal convictions, state license and Government program revocations, suspensions, exclusions and debarments, and also
4. Any current Medicare payment suspension under any Medicare billing number.
This form does not require the new applicant’s owner to disclose the problems of the Company in our hypothetical, or even mention its existence, for 2 reasons. First, “payment suspension” is a very specific Medicare sanction, and usually not present in an overpayment demand case. Second, the disclosure is explicitly directed at the individual owner, and its wording does not extend it to other entities under the owner’s ownership or control. The operative text at Section 6 is:
1. Has the individual in Section 6A, under any current or former name or business identity, ever had a final adverse legal action listed on page 16 of this application imposed against him/her?
New program developments in Medicare, however, may change the above situation and extend required disclosures to entities under common ownership or control with new applicants. In the HHS OIG Work Plan for FY 2012, under Part IV: Legal and Investigative Activities Related to Medicare and Medicaid, there is an item captioned Providers and Suppliers with Currently Not Collectible Debt. This proposes that
We will also determine whether [currently not collectible] debtors are closely associated with other businesses that continue to receive Medicare payment. CMS defines a [currently not collectible] debt as a Medicare overpayment that remains uncollected 210 days after the provider or supplier is notified of the debt and for which recovery attempts by CMS contractors have failed.
No mention is made in the Work Plan of what if any sanctions HHS is considering against businesses “closely associated” with its defaulting debtors, but affiliates of defaulting overpayment debtors are clearly a topic of concern to the agency. So, program changes on this subject may be forthcoming, and would logically be brought to bear in the new provider enrollment process.
Means already exist for CMS and its contractors to identify other providers under common ownership with a defaulting debtor by simple data mining, and any individual Government employee familiar with the overpayment could connect that to the new enrollment application if it came to their personal attention. So with or without changes coming from the Work Plan, there is a substantial risk that in our hypothetical, CMS or its contractors would become aware of the connection between the new application and the Company’s unsatisfied overpayment.
CMS’s authority to deny new enrollments into its programs is set forth in regulations enacted under the Social Security Act at 42 CFR §424.530(a). Grounds for denial of enrollment are similar to grounds for exclusion, and include (for example) felony convictions and program debarments and exclusions of
[a] provider, supplier, an owner, managing employee, an authorized or delegated official, medical director, supervisiong official, or other health care personnel furnishing reimburseable Medicare services who is required to be reported on the enrollment application, in accordance with section 1862(e)(1) of the Act….
Denial of enrollment based on an existing overpayment is expressly mentioned in this regulation as follows:
(6) Overpayment. The current owner (as defined in §424.502), physician or nonphysician practitioner has an existing overpayment at the time of filing of an enrollment application.
This provision does not include the Company’s overpayment in our hypothetical as grounds for denial of the new provider’s enrollment, and no other part of the regulation appears to do so either. So it appears that even if CMS or its contractor is aware of the affiliation of the Company and the new entity in our hypothetical, it could not deny the new enrollment. I believe that in practice, however, it is highly likely the agency would strive to find other grounds for denial in such a case, and the affiliation with the Company would make enrollment extremely difficult for the new provider entity. Additionally, I expect that any changes to the Medicare enrollment process resulting from the OIG Work Plan discussed above would include an expansion of the grounds for denial of enrollment to include overpayments by entities under common control with the applicant.
(c) Sanctions Against Companies Under Common Ownership or Control. If we add to our hypothetical another existing health care provider business which is incorporated as an entity separate from the Company but under common ownership or control, another question arises. What are the risks that CMS and its contractors might punish a failure to satisfy a proven overpayment demand with sanctions against the other existing Medicare provider entity? In the veil-piercing and successor liability topics above, we noted that such acts as ignoring the formalities of legal separateness between the Company and the other provider entity, and transferring assets between them, can allow creditors such as CMS and its contractors to pursue their debt claims against both entities. But as also noted in that topic, such remedies are hard to invoke, disfavored by courts in practice, and seldom used by Government agencies. So our inquiry turns to exclusion of the other entity from Government programs and revocation of its Medicare enrollment.
The relevant portion of the Social Security Act, 42 USC §1320a-7(b)(8), allows incorporated entities to be excluded if a 5% or more owner or control person has been excluded. The Company’s owners will own the other entity in our hypothetical, so if the conduct of the Company were grounds to exclude the owners, §1320a-7(b)(8) would allow the other entity to be excluded likewise. But as discussed in (a), above, the PIM exclusion requirements make it unlikely that the exclusion sanction could be applied in a normal overpayment case. Likewise, the revocation of enrollment regulations do not identify an overpayment by a provider under common control as grounds for revocation. Accordingly, no clear avenue exists under current Medicare law and policy to exclude or revoke the enrollment of the commonly owned provider in our hypothetical.
9. Conclusion. In sum, the established legal rule of limited liability of owners of incorporated businesses appears to be alive and well in the Medicare service provider area, and Federal agencies and their contractors by and large respect it. The separateness of legally-distinct incorporated businesses under common ownership also remains in effect. These rules however have significant exceptions.
Owners of incorporated health care provider entities, absent some written agreement to the contrary, are insulated from personal liability for overpayment obligations owed by their companies to Federal health care authorities by the same state laws which insulate them from their companies’ other debts. Generally, Federal health care laws do not change these rules. If your company’s assets are insufficient to satisfy its debts, procedures exist for Federal claimants (like other creditors) to try to reach through your company and pursue your personal credit to satisfy their claims. But this requires a lawsuit to be filed against you personally; and the laws of the states specify only certain narrow circumstances where they can be successful. Accordingly, creditors rarely try to “pierce the corporate veil”, and this is probably more true of Federal creditors than private ones.
The most likely situation where an insolvent provider’s creditor can successfully reach the personal credit of the owner is when the owner has taken dividends and other sums from the company which cannot be characterized as salary or compensation for employment, at times when the debtor company was already insolvent. Likewise, the most likely way a new provider company being organized by an existing provider’s owner can become liable to its creditors is for assets to be transferred from the old provider to the new. Owners of multiple providers should consult legal counsel to examine all dealings between them for successor liability and similar issues whenever one provider becomes liable for overpayments, because many risk-creating activities will not be recognizable as such without legal training.
Apart from debt collection risks, procedures exist for HHS to exclude owners of providers from Federal programs, which will operate to exclude other provider entities under common ownership. The available grounds for exclusion, however, do not normally arise in an overpayment case. Similarly, HHS regulations provide for the revocation of the enrollment of health care providers in certain cases. The grounds for revocation do not include a defaulted overpayment by a separate provider under common control.
The main area of risk for the affiliates of a defaulting provider subject to an overpayment appears to be the enrollment application by a new provider entity under common ownership. While the strict wording of the current enrollment application forms does not compel disclosure of the overpayment situation in our hypothetical, and overpayment by a commonly-owned provider is not currently a listed basis for denial of the new enrollment, in practice the existence of a defaulted overpayment obligation poses a substantial risk to any related party’s enrollment. Initiatives are under way inside HHS which could change these risks to certainties.
David Parker is an attorney practicing at Liles Parker PLLC, a health care and business law firm in Washington D.C. Mr. Parker was formerly a partner at Dickstein Shapiro in Washington, DC. Before entering private practice, Mr. Parker served for 16 years as the in-house general counsel of Allied Capital, a publicly-traded group of mezzanine finance companies headquartered in Washington. For more information, contact David at (202) 298-8750.
 The term incorporated will be used here to refer to the legal process of creating any form of legal entity providing limited liability to its owners (e.g. limited partnerships and LLCs) not just to the creation of a corporation.
 This practice is harder to defend than a claim for initial undercapitalization, because in this case there is evidence that at the time of organization, the owners believed the capital later taken out was needed in the business.
 Failure to hold annual meetings, and failure to keep corporate minutes have seldom been the basis for shareholder liability.
. 11 U.S.C. §362.
 11 USC §362(b)(28)
 See In re Slater Health Center, Inc. 398 F.3d 98 (C.A. 1 2005). The US Bankruptcy Code does not explicitly address recoupment, and the Slater ruling may not apply in all circumstances. Among other things, its application turns on the overpayment and the new billing being part of the “same transaction.” Otherwise, the contractor’s claim against the new billing is a setoff which is specifically addressed in the Code and is generally halted in bankruptcy by the automatic stay. See for example In re University Medical Center 973 F.2d 1065 (C.A.3 1992).
 The notable exception to this rule is the Internal Revenue Service’s pursuit of shareholders to collect corporate tax liability. The IRS has in recent years successfully pierced the corporate veil in a number of well-publicized cases.
 See e.g. Cab-Tek v. E.B.M. Inc. 153 Vt. 432 (Vt. 1990).
 Typical statements of states’ successor liability rules can be found in Marks v. Minn Mining & Mfg. Co 187 Cal. App. 3d 1429 (Cal. Ct. App. 1986) and Sweatland v. Park Corp 587 NYS 2d 54 (App. Div. 1992).
 Codified in 42 USC §§1320a-7 and 1320c-5
 The recurring text appears, for example, in 42 USC §1320a-7(b)(6). That section provides that the Secretary of HHS may exclude “Any individual or entity that the Secretary determines… has furnished or caused to be furnished … items or services to patients substantially in excess of the needs of such patients….” Since owners of a provider entity are normally in control of it, if the entity has done the described act, the owner can be said to have caused the act, and is therefore subject to the same grounds for exclusion [emphasis added].
 42 USC §1320a-7(b)6)
 PIM Ch. 4 Sec. 4.19.2. Similar procedural requirements for exclusion appear at 220.127.116.11 and 18.104.22.168.
 Other versions of CMS-855 (used for other types of providers and entities) contain sections corresponding to Sections 6, page 16 and Section 15 of CMS-855A, discussed herein.
 Sec. 15 of CMS-855A extends the required disclosure to all subsequent periods, effectively making it an Evergreen requirement.
 For example, CMS-855 program application forms have long required owners of all applicants to be identified by name and Social Security Number. A simple cross-checking of these identifiers against identifiers of owners from the CMS-855 of defaulting debtors could easily be implemented.
 Grounds for denial of enrollment are repeated, but not expanded, in the Medicare Program Integrity Manual in Chapter 15.8.
 42 CFR §424.530(2).
 42 CFR §424.530(6). The regulation defining the term owner includes holders of 5% and greater ownership interests. Grounds for denial of enrollment based on payment suspension are set forth in nearly identical language in §424.530(7)
 See 42 CFR §424.535. Note that this revocation regulation includes a grounds for revocation corresponding to §424.530(a)(2) [felony conviction, debarment or suspension by the provide, its owner or key personnel] but no grounds for revocation corresponding to §424.530(a)(6) [existing overpayment by the provider or its owner].